Signup Flow Cro

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:24 PM UTC
• Version:
  1.0.0

Overview

This is a signup conversion advice skill with no executable code and only a narrow, disclosed local context read.

Safe to install for signup-flow optimization advice. Review any `.agents/product-marketing-context.md` or `.claude/product-marketing-context.md` file first and keep secrets, credentials, and highly sensitive business data out of it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The eval explicitly rewards triggering on vague, casual phrasing for signup issues without defining clear boundaries, which can cause the skill to activate for loosely related requests. Over-broad routing increases the chance of misclassification, incorrect advice, and suppression of more appropriate skills when user intent is ambiguous.

VirusTotal

66/66 vendors flagged this skill as clean.